]> Git Repo - linux.git/commit
drm/xe/vm: move xa_alloc to prevent UAF
authorMatthew Auld <[email protected]>
Wed, 25 Sep 2024 07:14:27 +0000 (08:14 +0100)
committerMatthew Auld <[email protected]>
Fri, 27 Sep 2024 08:28:58 +0000 (09:28 +0100)
commitdcfd3971327f3ee92765154baebbaece833d3ca9
treeba9f3374bea95dae78a17aa9c05b2a35c4952492
parent8ec5a4e5ce97d6ee9f5eb5b4ce4cfc831976fdec
drm/xe/vm: move xa_alloc to prevent UAF

Evil user can guess the next id of the vm before the ioctl completes and
then call vm destroy ioctl to trigger UAF since create ioctl is still
referencing the same vm. Move the xa_alloc all the way to the end to
prevent this.

v2:
 - Rebase

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Auld <[email protected]>
Cc: Matthew Brost <[email protected]>
Cc: <[email protected]> # v6.8+
Reviewed-by: Nirmoy Das <[email protected]>
Reviewed-by: Matthew Brost <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
drivers/gpu/drm/xe/xe_vm.c
This page took 0.044041 seconds and 4 git commands to generate.